Kerberos Keytabs and HBase (and Ambari)

I am trying to run the Ambari Service Check in the latest HDP 2.2 for HBase, but am hitting two problems. The first is to do with Kerberos Keytabs. (Yes – I have a secure cluster)
I already have a /etc/security/keytabs/hbase.service.keytab file, but the service check was trying to use the non existant hbase.headless.keytab file.
Presumably it is getting the file name from hbase_user_keytab – which was hbase.headless.keytab
But this confuses me. Do all users of Hbase need the same keytab? Surely we all have different ones?